1. Field of the Invention
Embodiments of the present invention generally relate to telecommunications systems and, more particularly, to a method and apparatus for generating a reconnaissance index for a communications network, such as a packet network (e.g., an Internet Protocol (IP) network, such as is equally applicable to IPv4 and IPv6 networks).
2. Description of the Related Art
Presently, there are very few quantitative industry references that are capable of indicating the level of malicious reconnaissance or scanning activity that exists on the Internet. Any network subscriber that connects to the Internet should expect to experience some scanning activity, but the level of activity is capable of changing on a daily basis. However, the Internet subscriber does not typically have a point of reference that can illustrate what activity is prominent and how much activity should be expected. Deviations from an expected level of activity may suggest the subscriber may be targeted for attack. A significant increase in activity may have a detrimental impact to network performance, and therefore it is useful to have a measure of such activity to indicate a highly promiscuous network worm, for example.
Thus, there is a need in the art for a method and apparatus for generating a reconnaissance index that can be used to gauge the level of reconnaissance or scanning activity.